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The  Honorable  Hershel  W.  Gober 
The  Acting  Secretary  of  Veterans  Affairs 

Dear  Mr.  Secretary: 

In  May  we  testified*  before  the  Subcommittee  on  Oversight  and 
Investigations,  House  Committee  on  Veterans’  Affairs,  on  the  Department 
of  Veterans  Affairs’  (VA)  efforts  to  address  the  recommendations  in  our 
July  1998  report  entitled  VA  Information  Technology;  Improvements 
Needed  to  Implement  Legislative  Reforms.^  We  found  that  VA  had  made 
progress  in  addressing  our  1998  recommendations.  For  example,  compared 
with  its  fiscal  year  1999  information  technology  (IT)  investment  review 
process,  VAs  fiscal  year  2001  process  provided  decisionmakers  with  more 
detailed  information  on  proposed  projects. 

However,  we  also  noted  that  VA’s  progress  in  addressing  other  key  issues 
had  been  limited,  such  as  appointing  an  assistant  secretary  for  information 
and  technology,^  developing  an  overall  strategy  for  reengineering  its 
business  processes,  and  developing  an  integrated  IT  architecture.  Further, 
VA  faced  challenges  in  developing  and  implementing  three  key  IT 
projects— the  Master  Veteran  Record;  the  Veterans  Benefits 
Administration’s  information  systems  modernization,  also  known  as  the 
Veterans  Service  Network;  and  the  Veterans  Health  Administration’s 
decision  support  system. 

Taken  together,  these  remaining  issues  will  need  to  be  successfully 
addressed  if  VA  is  to  realize  its  goal  of  “One  VA”  and  meet  the  provisions  of 
the  Clinger-Cohen  Act.  Sustained  top  management  support  and  leadership 
will  also  be  required.  To  assist  you  in  bringing  this  about,  we  are  making 
recommendations  to  you  based  on  the  suggestions  we  made  in  our  May 
2000  testimony,  which  is  reprinted  as  appendbc  1. 


'InformaUon  Technology:  Update  on  VA  Actions  to  Implement  Critical  Reforms 
(GAOfr-AIMD-00-74,  May  1 1 ,  2000) . 

^GAO/AIMD-98-154,  July  7. 1998. 

*This  position  is  intended  to  serve  as  VA’s  chief  information  officer  (CIO). 
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We  performed  our  work  from  July  1999  through  April  2000.  in  accordance 
with  generally  accepted  government  auditing  standards.  VA  provided  us 
with  comments  on  a  draft  of  this  report.  These  comments  are  discussed  in 
appendkIL  Evaluation”  section  and  are  reprinted  as 


Timely  in-process  reviews  are  a  key  component  of  the  IT  decision-makina 
Scommend  thaf  *  approved  projects.  We  therefore 

mak^tfss  by  “  d---- 

establishing  and  monitoring  deadlines  for  completing  formal  in-process 

reviews  at  key  milestones  in  a  project’s  life  cycle:  Process 

^  investment  panel  members,  with 

^  .k"  post-implementation  reviews  of  IT 

projects  so  that  they  can  use  such  data  in  making  better  informed 
judgments  about  projects;  and  mrormea 

developing  and  implementing  guidance  to  better  manage  IT  projects 
below  the  Capital  Investment  Board  (CIB)  threshold.  ^  ^ 

Full  implementation  of  key  provisions  of  the  Clinger-Cohen  Act  is  required 
IhprtT  a  foundation  for  an  agency's  effective  use  of  IT  We 

vSor  ’’  “  PPhieve  the 

'  whh  departmenti  CIO  or  designee  to  lead  the  effort  and  work 

with  W  business  owners  to  develop  a  logical  architecture  as  a  step 
toward  an  integrated  IT  architecture.  ^ 

As  you  know,  the  head  of  a  federal  agency  is  required  by  31  U  S  C  720  to 

‘  Committee  on  Governmental  Affairs  and  the  House 
ommittee  on  Government  Reform  not  later  than  60  days  after  the  date  of 
report.  A  written  statement  must  also  be  sent  to  the^olLe  lindSi^Me 
Committees  on  Appropnations  with  the  agency’s  first  request  for 
appropnations  made  more  than  60  days  after  the  date  of  this  report. 
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Agency  Comments  and 
Our  Evaluation 


In  commenting  on  a  draft  of  this  report,  VA  concurred  with  all  but  one  of 
our  six  recommendations.  Specifically,  it  did  not  concur  with  our 
recommendation  that  it  reassess  its  decision  to  delegate  business  process 
reengineering  to  the  individual  administrations.  The  department  stated  that 
the  administrations  best  understand  the  desired  outcomes  of  their  missions 
and  the  means  to  achieve  them,  and  that  business  process  reengineering  is 
a  constantly  evolving  function  that  is  not  conducted  in  a  vacuum.  VA  added 
that  the  combination  of  reengineering  with  an  enterprise  IT  architecture 
and  IT  capital  investment  process  will  provide  the  department  with  the 
processes  and  strategies  necessary  to  ensure  that  business  process 
reengineering  will  be  accomplished. 

We  agree  that  individual  administrations  best  understand  their  own 
operations  and  that  business  process  reengineering  is  an  evolving  function 
that  does  not  take  place  in  a  vacuum.  However,  by  delegating  primary 
responsibility  for  reengineering  to  the  individual  administrations,  each 
administration  is  able  to  pursue  its  own  reengineering  initiatives  rather 
than  focusing  on  achieving  the  “One  VA"  vision.  Accordingly,  this  approach 
would  make  it  more  difficult  for  the  department  to  provide  efficient, 
unified  services  to  veterans.  Regarding  VA’s  comment  on  the  department’s 
enterprise  IT  architecture  and  IT  capital  investment  process,  we  pointed 
out  in  our  May  11,  2000,  testimony  that  VA’s  IT  architecture  has  several 
weaknesses.  Specifically,  VA  had  not  documented  the  logical  architecture 
showing  the  business  processes,  information  flows  and  relationships, 
applications  processing,  and  data  description  layers  for  the  department. 
Without  an  integrated,  departmentwide  architecture,  VA  lacks  a  framework 
for  maintaining  existing  IT  and  for  acquiring  new  IT  to  achieve  the  agency’s 
strategic  and  IT  goals.  We  also  note  in  this  report  that  VA  needs  to  take 
several  actions  to  improve  the  department’s  IT  capital  investment  decision¬ 
making  process.  Strengthening  VA’s  architecture  and  IT  investment 
decision-making  process,  along  with  implementing  a  departmentwide 
approach  to  business  process  reengineering,  are  therefore  essential  to  the 
department’s  achieving  its  “One  VA”  vision. 


We  are  sending  copies  of  this  report  to  Senator  Christopher  S.  Bond, 
Senator  Robert  Byrd,  Senator  Tom  Harkin,  Senator  Barbara  Mikulski, 
Senator  John  D.  Rockefeller,  Senator  Arlen  Specter,  and  Senator  Ted 
Stevens,  and  Representative  Michael  Bilirakis,  Representative  Corrine 
Brown,  Representative  Sherrod  Brown,  Representative  Lane  Evans, 
Representative  Terry  Everett,  Representative  Bob  Filner,  Representative 


Page  3 


GAO/AIMD-00>226  VA  Actions  Needed  to  Implement  Critical  Reforms 


B-28S675 


Luis  Gutierrez,  Representative  Ron  Klink,  Representative  Alan  B.  Mollohan, 
Representative  Jack  Quinn,  Representative  Clifford  Stearns, 
Representative  Bob  Stump,  Representative  Fred  Upton,  and  Representative 
James  T.  Walsh,  in  their  capacities  as  Chairmen  or  Ranking  Minority 
Members  of  Senate  and  House  Committees  and  Subcommittees.  We  are 
also  sending  copies  of  this  report  to  the  Honorable  Jacob  J.  Lew,  Director, 
Office  of  Management  and  Budget.  Copies  will  also  be  made  available  to 
others  upon  request. 

Should  you  or  your  staff  have  any  questions  concerning  this  report,  please 
contact  me  at  (202)  512-6253. 1  can  also  be  reached  by  e-mail  at 
willemssenj.aimd@gao.gov.  You  may  also  contact  Helen  Lew,  Assistant 
Director,  at  (202)  512-9356,  or  by  e-mail  at  lewh.aimd@gao.gov.  Individuals 
making  key  contributions  to  this  report  included  Tonia  Johnson  and  J. 
Michael  Resser. 

Sincerely  yours. 


Joel  C.  Willemssen 

Director,  Civil  Agencies  Information  Systems 
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Mr.  Chairman  and  Members  of  the  Subcommittee: 

We  appreciate  the  opportunity  to  participate  in  today  s  hearing  on  the 
Department  of  Veterans  Affairs'  (VA)  proposed  $1.4-biIIion  information 
technology  (IT)  program,  and  how  VA  is  using  IT  to  better  serve  our 
nation's  veterans.  In  July  1998  we  reported'  that  VA  had  not  fully 
implemented  critical  provisions  of  the  Clinger-Cohen  Act  and  related 
legislative  IT  reforms.^  We  also  made  several  recommendations  for 
improving  VA’s  IT  program. 

We  will  begin  today  by  discussing  VA’s  efforts  to  address  our  1998 
recommendations,  especially  those  calling  for  institutionalizing  a 
disciplined  IT  investment  decision-making  process,  developing  an  overall 
business  process  improvement  strategy  to  accomplish  reengineering,  and 
completing  an  integrated  IT  architecture.^  Next,  as  requested,  we  will 
discuss  the  status  of  VA's  actions  to  develop  and  implement  a  Master 
Veteran  Record;  the  Veterans  Benefits  Administration’s  (VBA)  actions  to 
modernize  its  information  systems,  also  known  as  the  Veterans  Service 
Network,  or  VETSNET;  and  the  Veterans  Health  Administration’s  (VHA) 
actions  to  implement  its  Decision  Support  System.  Finally,  we  will  discuss 
VA’s  steps  to  improve  computer  security  across  the  department. 

In  brief,  VA  has  made  progress  in  addressing  our  1998  recommendations. 
For  example,  compared  with  its  fiscal  year  1999  IT  investment  review 
process,  VA  s  fiscal  year  2001  process  provided  decisionmakers  with  more 
detailed  information  on  proposed  projects.  However,  the  department  has 
yet  to  fill  the  position  of  assistant  secretaiy  for  information  and 
technology,  created  in  June  1998  and  intended  to  serve  as  VA’s  chief 
information  officer  (CIO).  It  also  has  not  developed  an  overall  strategy  for 
reengineering  its  business  processes  to  effectively  function  as  “One  VA.”  a 
vision  the  department  has  articulated,  nor  has  it  defined  the  integrated  IT 


'  VA  Infonnatlon  Technology:  Improvements  Needed  to  Implement  Legislative  Refomis  (GAO/ 
AIMD-98-154,  July?,  1998). 

^The  Clingcr-Cohcn  Act  and  related  legislative  reforms— the  Paperwork  Reduction  Act  of  1995  and  the 
Federal  Acquisition  Streamlining  Act  of  1994— provide  direction  on  how  federal  agencies  should  plan, 
manage,  and  acquire  fT.  or 

^An  Integrated  IT  architecture  is  a  blueprint  consisting  of  logical  and  technical  components  to  guide 
and  constrain  the  development  and  evolution  of  a  collection  of  related  systems.  At  the  logical  level,  the 
architecture  provides  a  high-level  description  of  an  organization’s  mission,  the  business  functions 
being  performed  and  the  relationships  among  the  functions,  the  information  needed  to  perform  the 
functions,  and  the  flow  of  Information  among  functions.  At  the  technical  level,  the  architecture 
provides  the  rules  and  standards  needed  to  ensure  that  the  interrelated  systems  are  built  to  be 
interoperable  and  maintainable.  These  include  specifications  of  critical  aspects  of  component  systems’ 
hardware,  software,  communications,  data,  security,  and  performance  characteristics. 
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architecture  needed  to  efficiently  acquire  and  utilize  information  systems 
across  VA. 

VA  likewise  faces  challenges  in  developing  and  implementing  a  Master 
Veteran  Record.  VETSNET,  and  the  Decision  Support  System.  Its  Master 
Veteran  Record  project  has  not  been  implemented  by  VBA's  compensation 
and  pension  service  line,  although  this  project  could  help  reduce 
overpayments  through  faster  receipt  of  death  notices.  VBA's  VETSNET 
project  has  experienced  many  schedule  delays,  and  the  agency  has  not  yet 
established  a  completion  date  for  it.  Finally.  VHA’s  Decision  Support 
System,  while  completed,  is  not  being  fully  used  by  the  agency  for  the 
purposes  intended,  including  budget  formulation  and  resource  allocation. 

Regarding  computer  security,  VA  has  begun  to  address  weaknesses 
identified  by  us  and  by  its  Office  of  the  Inspector  General  (OIG) . 
Nevertheless,  it  still  needs  to  complete  guidance  on  assessing  the 
department’s  security  risks  and  must  develop  appropriate  policies  and 
controls  for  accessing  its  computer  systems. 


Background 


The  department’s  vision  of  “One  VA"  was  articulated  to  assist  it  in  carrying 
out  its  mission  of  providing  benefits  and  other  services  to  veterans  and 
dependents.  This  vision  stems  from  the  recognition  that  veterans  think  of 
VA  as  a  single  entity,  but  often  encounter  a  confusing,  bureaucratic  maze 
of  uncoordinated  programs—such  as  those  handling  benefits,  health  care, 
and  burials—that  puts  them  through  repetitive  and  frustrating 
administrative  procedures  and  delays.  According  to  the  department,  the 
“One  VA"  vision  describes  how  it  will  use  information  technology  in 
versatile  new  ways  to  improve  services  and  enable  VA  employees  to  help 
customers  more  quickly  and  effectively. 

To  implement  this  vision  and  cany  out  other  activities,  VA  plans  to  spend 
about  $1.4  billion  of  its  proposed  fiscal  year  2001  budget  of  about  $48 
billion  on  various  IT  initiatives.  Of  this  $1.4  billion,  about  $763  million,  $80 
million,  and  $400,000,  are  intended  for  VHA,  VBA.  and  the  National 
Cemeteiy  Administration  (NCA) .  respectively.  The  remaining  $589  million 
is  for  VA-wide  IT  initiatives  in  the  financial  management,  human 
resources,  infrastructure,  security,  architecture,  and  planning  areas. 

The  Clinger-Cohen  Act  and  other  related  legislative  reforms  provide 
guidance  on  how  agencies  should  plan,  manage,  and  acquire  IT  as  part  of 
their  overall  information  resources  management  responsibilities.  These 
reforms  require  agencies  to  appoint  CIOs  responsible  for  providing 
leadership  in  acquiring  and  managing  IT  resources.  They  also  require 
agencies  to  perform  business  process  reengineering  prior  to  acquiring  new 
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IT  and  to  complete  an  integrated  architecture  to  guide  and  constrain 
future  investments. 


VA  Has  Made 
Progress  in 
Institutionalizing  the 
IT  Investment  Process 


The  CUnger-Cohen  Act  requires  agency  heads  to  implement  an  approach 
for  maximizing  the  value  and  assessing  and  managing  the  risks  of  IT 
investments.  It  stipulates  that  this  approach  should  be  integrated  with  the 
agency’s  budget,  financial,  and  program  management  processes.  As 
detailed  in  our  investment  guide, ^  an  IT  investment  process  is  an 
integrated  approach  that  provides  for  disciplined,  data-driven 
identification,  selection,  control,  life-cycle  management,  and  evaluation  of 
IT  investments. 


As  shown  in  table  1,  VA's  decision-making  process  for  IT  investments 
varies  depending  upon  the  proposed  project’s  cost,  risk,  and  visibility.  An 
IT  project  starts  vrith  a  VA  administration  or  office  developing  a  project  to 
address  business  needs  and  preparing  a  formal  proposal  for  review  and 
approval.  Then,  projects  with  high  cost,  risk,  or  visibility  are  assessed  as 
part  of  VA’s  capital  in  vestment  planning  process,  including  review  by  its 
Capital  Investment  Board  (CIB).  This  board  is  composed  of  the  deputy 
secretary,  the  assistant  secretary  for  congressional  affairs,  the  assistant 
secretary  for  information  and  technology,  the  general  counsel,  the 
assistant  secretary  for  financial  management,  the  assistant  secretary  for 
planning  and  analysis,  and  the  undersecretaries  for  health,  benefits,  and 
memorial  affairs.  It  reviews  projects  that  exceed  specific  dollar  thresholds 
or  that  are  seen  as  high  risk  or  high  visibility.  The  dollar  thresholds  for 
VHA,  VBA,  NCA,  and  staff  offices  are  acquisition  costs  of  $10  million, 

$2  million,  $1  million,  and  $1  million,  respectively,  and/or  life-cycle  costs 
of  $30  million.  $6  million.  $3  million,  and  $3  million,  respectively.  Lower 
cost  projects  are  not  reviewed  by  the  CIB.  Instead,  they  are  decided  upon 
and  overseen  by  VA  administrations/offices.  Those  projects  over  $250,000 
are  also  monitored  by  VA’s  Office  of  Information  and  Technology  (OI&T) . 


^Assessing  Risks  and  Returns:  A  Guide  for  Evaluating  Federal  Agencies’  IT  Investment  Decision¬ 
making  (GAO/AIMD-10.1.13.  February  1997). 
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Table  1:  Summary  of  VA  Decision-making  and  Oversight  by  Type  of  IT 
Project 


Type  of  VA  decision/overstght 


Type  of  IT  project  Select 

Approve 

Control 

Evaluate 

High  (x>st/riskA/isibility:  Administration/ 

Projects  that  meet  office 

dollar  thresholds  for 

review  by  CIB  or  are 

high  risk  or  high 

visibility 

VAC  IB 

VA  OI&T 
approval 

VA  in-process 
reviews 

VA  post¬ 
implementation 
reviews 

VA  internal 
reviews  and 

OIG  reviews 

Execution 

reviews 


Internal 
reviews  and 
OIG  reports 


Medium  cost: 

Projects  greater  than 
$250,000  but  less  than 
the  thresholds  for 
review  by  CIB 

Administration/ 

office 

VA  OI&T 
approval' of 
procurements 

VA  OI&T 
follow-up  on 
approval*  of 
procurements 

VA  internal 
reviews  and 

OIG  reviews 

Low  cost: 

Administration/ 

Administration/ 

Administration/ 

Administration/ 

Projects  less  than 
$250,000 

office 

office 

office 

office 

'Exceptions  to  the  requirement  for  approval  include  items  purchased  under  VA’s 
departmentwide  procurement  computer  hardware  and  software  contract  and  purchases  of 
picture  archiving  and  retrieval  systems. 


Source;  VA. 

As  shown  in  figure  1,  projects  that  require  approval  by  the  CIB  are 
submitted  by  the  applicable  administration/office  to  the  department’s  CIO 
Council  Investment  Panel.  This  panel  evaluates  and  ranks  IT  proposals  for 
the  CIO  Council.  The  council  then  reviews  the  proposals  and  forwards 
selected  ones  to  the  Capital  Investment  Panel.  This  panel  ranks  and  scores 
both  IT  and  non-IT  projects  and  makes  recommendations  to  the  CIB, 
which  then  makes  recommendations  to  the  Secretary  for  inclusion  in  the 
department’s  capital  plan  and  annual  budget  request. 
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Figure  1:  VA’s  Investment  Decision<makIng  Process 


Although  VA  had  established  a  detailed  process  for  selecting,  controlling, 
and  evaluating  IT  investments,  discipline  within  the  process  was 
previously  lacking.  Specifically,  we  reported  in  July  1998^  that  VA 
decisionmakers  did  not  have  current  and/or  complete  information — such 
as  cost,  benefit,  schedule,  risk,  and  performance  data  at  the  project  level — 
with  which  to  make  sound  investment  decisions.  In  addition,  VA's  process 
for  controlling  and  evaluating  its  investment  portfolio  was  incomplete  and, 
as  a  result,  decisionmakers  did  not  have  the  information  needed  to  detect 
or  avoid  problems  early  or  to  improve  the  VA  investment  process  for  the 
future. 

Accordingly,  we  made  several  recommendations  to  VA  to  improve  its 
selection,  control,  and  evaluation  of  IT  investments.  As  discussed  below, 
the  department  agreed  to  implement  them. 


5CA0/AIMD.98.154.  July?,  1998. 
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In  response  to  our  recommendation  that  it  implement  a  disciplined 
process  for  selecting  IT  investments  in  which  decisions  are  based  on 
complete  and  current  project  data,  VA  now  requires  its 
administrations/offices  to  meet  a  more  comprehensive  and  specific  set  of 
criteria.  The  selection  criteria  used  during  the  fiscal  years  2000  and  2001 
capital  investment  planning  processes  covered  areas  such  as  the  proposed 
projects’  (1)  impact  on  “One-VA”  customer  service,  (2)  return  on  taxpayer 
investment,  (3)  contribution  to  a  high-performing  workforce,  (4)  risks,  and 
(5)  comparison  with  alternatives.  VA  investment  review  panels®  then 
screened  proposals  to  ensure  that  they  had  adequate  information. 

The  proposals  submitted  for  the  fiscal  years  2000  and  2001  reviews  were 
much  more  complete  than  those  submitted  for  the  fiscal  year  1999 
investment  planning  process.  In  fiscal  year  1999,  none  of  the  seven 
proposals  that  we  reviewed  contained  all  the  required  information,  yet  all 
were  passed  by  the  CIB.  In  fiscal  year  2000,  by  contrast,  all  seven  of  the 
proposals  that  passed  VA’s  review  had  the  required  information,  including 
cost-benefit  analysis,  risk  analysis,  and  alternatives  analysis.  Similarly,  in 
the  fiscal  year  2001  review,  all  five  proposals  that  passed  VA’s  review 
generally  met  the  criteria. 


In  our  July  1998  report  we  stated  that  VA’s  process  for  monitoring  and 
managing  its  investment  portfolio  was  not  timely  and  provided 
decisionmakers  with  little  information.  We  recommended  that  VA  conduct 
formal  in-process  reviews  at  key  milestones  in  a  project’s  life  cycle  and 
provide  these  results,  along  with  results  of  periodic  project  status  reviews, 
to  those  responsible  for  deciding  whether  to  continue,  accelerate,  or 
terminate  IT  projects. 

VA  agreed  with  this  recommendation  and  has  taken  steps  to  implement  it. 
For  example,  in  response  to  our  recommendation  that  in-process  reviews 
be  conducted  at  key  milestones  of  a  project’s  life,  VA  recently  changed  its 
method  for  identifying  projects  for  such  reviews.  In  the  past,  in-process 
reviews  were  conducted  in  an  ad  hoc  manner,  such  as  when  it  became 
apparent  that  a  project  was  behind  schedule,  over  budget,  or  not 
performing  as  planned,  or  when  oversight  agencies  raised  questions.  Now, 
the  CIO  Council  plans  to  identify  projects  for  review  by  VA  OI&T  based  on 
the  council’s  assessment  of  the  project.  This  assessment  will  take  into 


®VA’s  CIO  Council  Investment  Panel  and  Capital  Investment  Panel. 
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consideration  the  results  of  execution  reviews’  and  input  from  project 
managers.  These  reviews  focus  on  whether  the  project  meets  cost, 
schedule,  and  performance  goals. 

Additionally,  VA  has  made  progress  in  responding  to  our  recommendation 
that  the  results  of  in-process  reviews  be  provided  to  decisionmakers. 
Specifically,  the  results  of  formal  in-process  reviews  are  given  to 
decisionmakers  along  with  the  results  of  post-implementation  reviews  and 
audits  of  IT  issues  conducted  by  VA’s  OIG. 

However,  the  in-process  reviews  may  still  not  be  timely.  As  of  April  28, 
2000,  VA  01  &T  has  only  completed  five  of  the  eight  in-process  reviews 
scheduled  for  fiscal  year  1999.  Without  timely  reviews,  VA  is  limited  in  its 
ability  to  control  approved  projects.  Accordingly,  it  is  important  that  VA 
establishes  and  monitors  deadlines  for  completing  in-process  reviews. 


VA  Has  Improved  Its  Post-  As  we  have  reported,  VA’s  post-implementation  reviews  had  not  contained 
ImDlementation  Reviews  assessment  of  whether  the  implemented  project  achieved  the  estimated 

^  cost,  schedule,  or  mission-related  benefits.®  Further,  VA  had  not  identified 

lessons  learned  that  could  be  used  to  improve  its  investment  process  for 
selecting,  controlling,  and  evaluating  IT  initiatives.  We  recommended  that 
VA  initiate  post-implementation  reviews  for  IT  projects  within  12  months 
of  implementation,  to  compare  completed  project  cost,  schedule, 
performance,  and  mission  improvement  outcomes  with  original  estimates, 
and  provide  the  results  of  these  reviews  to  decisionmakers  so  that 
improvements  can  be  made  to  VA’s  IT  process. 

VA  concurred  with  our  recommendation  and  has  taken  steps  to  improve 
its  process.  For  example,  in  three  of  the  four  post-implementation  reviews 
conducted  in  fiscal  year  1999,  actual  and  estimated  costs,  schedules,  and 
mission-related  benefits  were  compared.  The  remaining  review  did  not 
include  a  comparison  between  actual  and  estimated  costs. 

VA  also  now  identifies  lessons  learned  from  its  evaluation  of  completed 
projects,  and  documents  them  in  the  post-implementation  review  report. 
For  example,  among  the  lessons  learned  were  the  need  to  ensure  that  (1)  a 
variety  of  users  participate  in  the  decision-making  process  on  systems 
enhancements  and/or  user  modifications  and  (2)  user  documentation  is 


’These  reviews  arc  conducted  by  the  CIO  Council  Investment  Panel  and  Capital  Investment  Panel  to 
monitor  and  manage  projects  approved  by  the  CIB. 

*CAO/AIMD-98-154.  July  7, 1998. 
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readily  available  and  updated  regularly  to  reflect  the  latest  systems 
changes. 

However,  the  lessons  learned  are  provided  only  to  the  sponsoring  VA 
organizations,  and  not  to  decisionmakers,  such  as  the  investment  panel 
members,  who  could  also  benefit  from  them.  Decisionmakers  receive  only 
a  summary  of  the  audit  findings  in  post-implementation  reviews:  lessons 
learned  are  not  part  of  that  summary.  To  improve  the  department’s 
process  for  selecting,  controlling,  and  evaluating  IT  investments, 
decisionmakers  should  be  provided  with  such  lessons  learned  information 
so  they  can  use  it  in  making  better-informed  judgments  about  projects. 

IT  Investment  Process  for  As  previously  discussed.  IT  procurements  that  are  $250,000  and  greater. 

Projects  Below  CIB-Level  *®ss  than  the  thresholds  for  review  by  the  CIB,  must  be  approved  by 

Is  Not  as  Structured  9^^^'  Procurements  and  IT  projects  that  are  less  than  $250,000  are 

reviewed  at  the  administration/office  level.  The  capital  investment  process 
used  for  these  projects  is  less  structured  than  the  high-cost,  high-visibility 
projects  reviewed  by  the  CIB.® 

To  implement  the  approval  process  for  projects  above  $250,000  and 
beneath  the  CIB  thresholds.  VA  OI&T  has  issued  guidance— Planning 
and  Acquisitions  Handbook~to  project  sponsors.  Sponsors  requesting 
approval  must  submit  a  package  containing  key  information,  such  as  a 
requirements  analysis,  benefit/cost  analysis,  and  a  minimum  10  percent 
return  on  investment.  It  has  not  yet  issued  written  guidance  for 
(1)  monitoring  and  managing  approved  procurements  or  (2)  evaluating 
completed  projects.  VA  OI&T  is  now  in  the  process  of  revising  its 
handbook  to  address  these  areas. 

Guidance  for  IT  projects  costing  up  to  $250,000  is  partially  complete.  VBA 
has  issued  selection  process  guidance  entitled  Information  Technology:  ’ 
Investment  Board  and  Investment  Evaluation  Process  that  covers  all  IT 
projects,  including  those  under  $250,000.  It  requires  each  project  sponsor 
to  submit  a  package  containing  information  such  as  the  names  of  the  team 
members,  cost-effectiveness  analysis,  alternatives  analysis,  risk  analysis, 
and  performance  measures.  This  information  is  reviewed  by  VBA’s 
Information  Technology  Investment  Board.  The  board  reviews  the 
proposal  for  (1)  consistency  with  and  support  of  the  VAA^BA  mission, 
goals,  and  objectives,  along  with  technical  and  organizational  feasibility, 


^According  to  about  $814  million  of  its  $  1.2  billion  fiscal  year  1999  IT  investments  were  not  subject 
to  review  by  the  CIB:  these  were  the  most  recently  available  data. 
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and  (2)  completeness  of  project  plan,  cost-effectiveness  analysis,  and  risk 
analysis.  It  then  ranks  the  proposal  in  terms  of  risk  and  return.  VBA’s 
guidance  also  requires  its  Information  Technology  Investment  Board  to 
review  ongoing  projects.  VBA  has  not  issued  written  guidance  for 
evaluating  completed  projects,  but  a  VBA  official  told  us  that  the  agency  is 
in  the  process  of  developing  such  guidance. 

Lastly,  VHA  issued  written  guidance  this  past  January  for  selecting  IT 
investments  for  its  Office  of  Information,  which  manages  VHA-wide 
projects.  This  guidance  requires  project  sponsors  to  submit  cost-benefit 
analyses,  alternatives  analyses,  project  schedules,  and  a  discussion  of 
funding  sources.  VHA  offices  in  headquarters  and  the  field  have  typically 
relied  on  group  meetings  and  discussions  to  select  IT  initiatives.  According 
to  a  director  in  the  Office  of  Information,  VHA  is  currently  drafting 
guidance  for  selecting  IT  investments  at  its  field  offices.  VHA  does  not 
have  written  guidance  for  monitoring  and  managing  IT  procurements  nor 
does  it  have  guidance  for  evaluating  completed  projects.  VHA  plans  to 
develop  such  guidance,  but  it  has  not  established  a  date  for  when  this  will 
be  completed. 


VA  has  made  only  limited  progress  in  addressing  other  key  issues,  such  as 
appointing  full-time  CIOs,  developing  a  business  process  reengineering 
strategy,  and  developing  an  integrated  IT  architecture.  These  need  to  be 
addressed  if  the  department  is  to  effectively  use  IT  to  achieve  its  “One  VA" 
vision. 


Limited  Progress  Made  in  The  Clinger-Cohen  Act  and  the  Paperwork  Reduction  Act  direct  the  heads 
AoDOinting  Full-time  CIOs  federal  agencies  to  appoint  CIOs  to  (1)  promote  improvements  in  work 
°  processes  used  by  the  agencies  to  cany  out  their  programs,  (2)  implement 

integrated,  agencywide  systems  or  technology  architectures,  and  (3)  help 
establish  sound  investment  review  processes  to  select,  control,  and 
evaluate  IT  spending.  To  help  ensure  that  these  responsibilities  are 
effectively  executed,  the  act  requires  that  the  CIO’s  primary  responsibility 
be  related  to  information  management. 

As  we  reported  in  July  1998,  however,  the  responsibilities  of  VA’s  CIO 
were  not  limited  to  information  management.  Specifically,  the  CIO 
served  the  department  in  a  variety  of  top  management  positions,  including 


VA’s  Progress  in 
Addressing  Other 
Clinger-Cohen  Act 
Provisions  Has  Been 
Limited 


*®GAO/AIMD-98.154.July7, 1998. 
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assistant  secretary  for  management,  chief  financial  officer,  and  deputy 
assistant  secretary  for  budget.  We  noted  that  in  an  agency  as  decentralized 
as  VA,  the  CIO  was  faced  with  many  significant  information  management 
responsibilities.**  which  constitute  a  full-time  job  for  any  CIO. 

Accordingly,  we  recommended  that  the  Secretary  of  Veterans  Affairs 
appoint  a  CIO  with  full-time  responsibility  for  information  resources 
management  alone. 

VA  concurred  with  this  recommendation  and  established  the  position  of 
assistant  secretary  for  information  and  technology  to  serve  as  its  CIO. 
However,  this  executive  branch  position  has  been  unfilled  since  its 
creation  in  June  1998.  Accordingly,  the  Secretary  created  the  position  of 
principal  deputy  assistant  secretary  for  information  and  technology  and 
designated  that  person  as  VA’s  acting  CIO  until  an  assistant  secretary 
could  be  appointed.  The  Secretary  also  realigned  information  resources 
management  functions  within  VA  under  this  position. 

The  principal  deputy  assistant  secretary  for  information  and  technology 
has  reported  directly  to  the  Secretary  and  is  involved  in  IT  planning  issues 
across  the  department.  He  said  that  his  responsibilities  have  included 
advising  the  Secretary  on  IT  issues,  serving  as  chair  of  the  department’s 
CIO  Council  and  a  member  of  VA’s  CIB,  and  working  with  the  CIOs  in  VBA 
and  VHA.  He  sees  his  role  as  one  of  helping  them  use  IT  to  support  their 
administrations.  According  to  this  official,  one  of  his  priorities  has  been  to 
ensure  that  IT  activities  in  VBA  and  VHA  are  in  concert  with  VA's 
departmentwide  efforts. 

VA's  acting  CIO  recently  announced,  however,  that  he  will  be  retiring  from 
VA  at  the  end  of  this  month.  As  a  result,  VA  will  again  be  left  without  IT 
leadership,  and  the  CIO  position  will  have  been  vacant  for  almost  2  years. 

It  is  critical  that  this  position  be  filled  to  provide  the  leadership  to  achieve 
the  “One  VA”  vision  through  effective  IT. 

In  a  separate  yet  somewhat  similar  situation,  VHA  has  a  CIO  vacancy  that 
was  created  when  its  previous  CIO  left  the  agency  in  October  1999.  To 
address  this  situation,  in  November  1999  the  acting  undersecretary  for 
health  designated  VHA’s  chief  facilities  management  officer  as  VHA’s 
acting  CIO.  This  individual  currently  carries  both  responsibilities — for 
facilities  and  IT  management. 


**At  the  time,  these  responsibilities  included  ensuring  that  (I)  VA’s  systems  development  projects 
would  not  be  handicapped  by  incomplete  architectures  and  (2)  a  sound  information  management 
investment  review  process  providing  systematic,  data-driven  means  of  selecting,  controlling,  and 
evaluating  IT  projects  would  be  institutionalized. 
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According  to  VHA’s  acting  CIO,  he  devotes  approximately  60  to  75  percent 
of  his  time  to  information  management  activities.  He  acknowledged  that 
he  has  no  background  in  IT  and  relies  on  staff  to  provide  expertise  and 
guidance  in  this  area.  He  said,  however,  that  he  does  not  think  the 
allocation  of  his  time  or  lack  of  background  is  cause  for  concern, 
especially  given  his  background  in  and  knowledge  of  VHA.  His  immediate 
focus,  he  said,  is  to  bring  about  general  management  improvements  in 
VHA’s  Office  of  Information  for  such  areas  as  the  fiscal  process, 
communications,  and  project  management. 

We  believe  this  dual  responsibility  is  contrary  to  good  management 
practices,  and  that  the  VHA  CIO  should  have  information  management  as 
his  primary  focus.  We  have  stressed  the  importance  of  this  principle  in 
testimony  and  in  our  February  1997  high-risk  report,  in  which  we 
emphasized  that  the  CIO’s  duties  should  be  centered  on  strategic 
information  management  issues  and  not  include  other  major 
responsibilities. '2  VHA  is  no  exception:  it  needs  a  CIO  focused  on 
information  management. 


VA  No  Longer  Plans  to 
Develop  a 
Departmentwide 
Business  Process 
Improvement  Strategy 


The  Clinger-Cohen  Act  requires  agency  heads  to  analyze  the  missions  of 
their  agencies  and,  on  the  basis  of  this  analysis,  revise  and  improve  the 
agency’s  mission-related  and  administrative  processes  before  making 
significant  investments  in  supporting  IT.  As  our  business  process 
reengineering  guide'^  makes  clear,  an  agency  should  have  an  overall 
business  process  improvement  strategy  that  provides  a  means  to 
coordinate  and  integrate  the  various  reengineering  and  improvement 
projects,  set  priorities,  and  make  appropriate  budget  decisions. 


Our  1998  report  noted  that  VA  had  not  analyzed  its  business  processes  in 
terms  of  implementing  its  “One  VA”  vision.  We  also  pointed  out  that  VA  did 
not  have  a  departmentwide  business  process  improvement  strategy 
specifying  what  reengineering  and  improvement  projects  were  needed, 
how  they  were  related,  and  how  they  were  prioritized.  At  the  time,  VA 
concurred  with  our  recommendation  to  develop  such  a  strategy. 


Government  Reform:  legislation  Would  Strengthen  Federal  Management  of  Information  and 
Technology  (CAO/T-AIMD-95-205,  July  25, 1995),  Managing  Technology:  Best  Practices  Can  Improve 
Performance  and  Produce  Results  (GAO/T-AlMD-97-38.  January  31 . 1997),  High-Risk  Series: 
Information  Management  and  Technology  iGAO/HR-57-9,  Fcbruaiy  1997),  and  Chief  Information 
OfTicers:  Ensuring  Strong  Leadciship  and  an  Effective  Council  (GAO/T-AlMD-98-22,  October  27, 1997). 

Business  Process  Reengineering  Assessment  Guide  (GAO/AIMD-10.t.l5,  April  1997). 
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VA’s  assistant  secretary  for  policy  and  planning  and  principal  deputy 
assistant  secretary  for  information  and  technology  have  now,  however, 
informed  us  that  VA  no  longer  plans  to  develop  an  unified, 
departmentwide  business  process  improvement  strategy.  According  to  the 
assistant  secretary,  the  department  will,  instead,  rely  on  each  of  its 
administrations — VBA,  VHA,  and  NCA — to  reengineer  its  own  business 
process. 

As  we  reported  in  1998,  an  overall  business  process  improvement  strategy 
can  provide  the  means  to  coordinate  and  integrate  various  reengineering 
and  improvement  projects,  set  priorities,  and  make  appropriate  budget 
decisions.  Given  the  department's  approach  of  delegating  to  its  three 
major  components  reengineering  of  their  own  business  processes,  it  is 
unclear  how  VA  will  be  able  to  provide  veterans  with  a  unified  view  of  VA 
services.  Accordingly.  VA  should  either  reassess  its  “One  VA"  vision  or,  if  it 
is  committed  to  that  vision,  reassess  its  strategy  given  the  inconsistency  in 
its  approach. 


VA  Lacks  an 
Integrated  IT 
Architecture 


The  Clinger-Cohen  Act  and  Office  of  Management  and  Budget  guidelines 
require  agency  CIOs  to  implement  an  architecture  to  provide  a  framework 
for  evolving  or  maintaining  existing  IT  and  for  acquiring  new  IT  to  achieve 
the  agency’s  strategic  and  IT  goals.  Leading  organizations  both  in  the 
private  sector  and  in  government  use  systems  architectures  to  guide 
mission-critical  systems  development  and  to  ensure  the  appropriate 
integration  of  information  systems  through  common  standards.*^ 

A  VA  architecture  team  consisting  of  representatives  from  VA 
administrations  and  offices  issued  a  report  to  the  VA  CIO  Council  in  May 
1997  adopting  the  National  Institute  of  Standards  and  Technology  (NIST) 
five-layer  model  for  its  departmentwide  IT  architecture.  The  five  layers — 
business  processes,  information  flows  and  relationships,  applications 
processing,  data  descriptions,  and  technology — provide  a  framework  for 
defining  an  IT  architecture. 

However,  as  discussed  in  our  1998  report,  VA  and  its  components  had  yet 
to  define  a  departmentwide,  integrated  architecture.  Accordingly,  we 
recommended  that  VA  develop  a  detailed  implementation  plan  with 
milestones  for  completing  such  an  IT  architecture. 


^*Exccutive  Guide:  Improving  Mission  Performance  Through  Strategic  Jnfonnatlon  Management  and 
Technology — Learning  From  Leading  0rgani2atlons  {CAO/AIMD-94-1 15,  May  1994). 
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Although  VA  concurred  with  our  recommendation,  it  did  not  develop  a 
detailed  implementation  plan  with  milestones  for  completing  the 
architecture.  Instead,  VA  published  a  departmentwide  technical 
architecture,*®  which  includes  a  technical  reference  model  and  standards 
profile.  This  document  describes  only  one  element— the  technology 
layer— of  the  full  NIST  model.  VA  has  not  yet  documented  the  logical 
architecture  showing  the  business  processes,  information  flows  and 
relationships,  applications  processing,  and  data  description  layers  for  the 
entire  department. 

VA’s  principal  deputy  assistant  secretary  for  information  technology  said 
that  in  order  to  develop  the  logical  architecture,  the  business  owners 
would  have  to  be  involved.  However,  he  has  no  plans  to  bring  them 
together  to  begin  this  process.  He  believes,  instead,  that  their  individual 
business  process  reengineering  initiatives  will  eventually  result  in 
development  of  these  areas,  although  he  did  not  explain  how  this  would 
happen  without  guidance  from  VA.  We  believe  that  it  is  important  for  VA’s 
CIO  or  designee  to  take  the  leadership  role  and  work  with  the  business 
owners  to  develop  the  logical  architecture  so  that  the  department  can 
produce  an  integrated  IT  architecture. 

At  the  component  agency  level,  neither  VBA  nor  VHA  has  fully  defined  and 
documented  their  current  IT  architectures.  VBA's  new  CIO  recently  stated 
that  plans  to  hire  a  contractor  to  document  the  architecture  are  now  on 
hold  until  completion  of  a  new  information  systems  strategic  plan.  This 
individual  stated  that  the  IT  architecture  would  be  made  part  of  the  plan. 
Regarding  VHA’s  architecture,  our  analysis  of  its  most  recent  document,  IT 
Architecture — Fiscal  Year  1999  Plan,  shows  that  it  also  lacks  key  layers  of 
the  NIST  model.  It  contains  information  on  VHA’s  business  processes  and 
the  technology  infrastructure,  but  details  on  the  information  flows  and 
relationships,  applications  processing,  and  data  description  layers  are 
missing.  VHA’s  IT  architect  said  that  VHA  recognizes  that  it  needs  to 
complete  these  other  layers  of  the  architecture  but  does  not  have  an 
estimate  of  when  this  will  happen. 


VA  Faces  Challenges 
on  Three  IT  Projects 


As  you  requested,  we  will  now  discuss  the  status  of  VA’s  efforts  to  develop 
and  implement  three  IT  projects— VA’s  Master  Veteran  Record  (MVR) ; 
VBA’s  actions  to  modernize  its  information  systems,  also  known  as 
VETSNET;  and  VHA’s  Decision  Support  System.  Each  of  these  projects  is 


*®V4  Technicai  Architecture:  Tcchnica!  Reference  Model  and  Standards  Profile,  May  1999. 
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at  a  different  stage  of  development  and  implementation,  but  they  all  face 
challenges  ahead. 


MVR  Has  Not  Been  MVR— master  veteran  record— is  a  messaging  system  that  notifies  VA 

Completely  Implemented  components  and  offices  of  changes  in  common  veteran  data,  such  as  name 

Within  VBA  address.  Its  development  began  in  1994  and  vi^as  scheduled  to  be 

implemented  across  VA  by  1998.  at  a  cost  of  about  $8  million.  MVR  was 
expected  to  unify  VA  services  through  information-sharing  among  its 
administrations/offices,  improved  data  integrity  and  customer  service 
through  access  to  the  most  current  information,  and  reduced 
overpayments  through  more  current  death  notifications.  VA  further  hoped 
that  as  veterans  received  quicker  responses  and  more  complete  service, 
their  confidence  in  VA  would  increase. 

According  to  VA  s  principal  deputy  assistant  secretary  for  information  and 
technology,  the  MVR  project  was  completed  in  1999,  The  project  director 
told  us  that  MVR’s  life-cycle  cost  was  about  $4  million.  MVR  has  enabled 
the  transmission  of  messages  across  VHA,  NCA,  and  VA  staff  offices.  As 
anticipated,  these  messages  include  veteran  status  changes  such  as 
addresses  and  death  notifications,  which  can  be  reported  to  any  VA  office 
with  the  expectation  that  all  benefits  programs  operations  will  be 
informed  of  the  new  information.  According  to  VA,  MVR  has  begun  to 
produce  some  of  the  benefits  expected.  For  example,  VHA  medical  centers 
can  now  be  notified  more  quickly  of  changes  in  veterans’  benefits  status 
that  affect  hospital  eligibility.  However,  VA  is  unable  to  quantify  the 
benefits  attributable  to  MVR, 

Although  VA  considers  MVR  to  be  completed,  one  VA  administration — 
VBA — is  not  yet  fully  linked  to  the  system.  In  particular,  VBA’s  largest 
service  line,  compensation  and  pension,  does  not  yet  have  a  gateway  to 
receive  MVR  information,  such  as  address  changes  and  death  notifications, 
from  other  systems.  VBA  initially  stated  that  funding  and  policy  issues  had 
to  be  resolved  before  MVR  could  be  implemented,  yet  it  planned  to 
develop  the  gateway  needed  for  its  compensation  and  pension  benefits 
payments  system  to  become  fully  linked  to  MVR  by  December  1999.  VBA 
did  not,  however,  meet  this  deadline  due  to  a  departmental  request  that  it 
study  the  feasibility  of  using  an  existing  interface  between  VBA  and  NCA 
to  access  MVR.  As  of  April  28,  2000,  VBA  still  had  not  awarded  a  contract 
to  complete  this  study  and  develop  the  MVR  gateway. 

According  to  VA's  MVR  director,  the  delay  in  VBA’s  compensation  and 
pension  service  line  fully  linking  to  MVR  has  not  significantly  affected  the 
department’s  ability  to  realize  benefits.  While  unable  to  quantify  benefits 
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for  the  program,  he  s?id  that  MVR  is  paying  for  itself  today  as  VHA  uses 
the  system  for  its  enrollment  program,  specifically  to  determine  veterans' 
eligibility  for  medical  care  benefits. 

Notwithstanding  these  enrollment  related  benefits,  the  potential  additional 
benefits  of  MVR  could  be  significant  if  VBA’s  compensation  and  pension 
service  line  was  linked  to  it.  In  particular,  early  death  notifications  via 
MVR  could  help  minimize  compensation  and  pension  overpayments  to 
veterans  who  had  died.  According  to  a  December  1996  report  by  VA’s  OIG 
on  compensation  and  pension  overpayments,  20  percent  of  overpayments 
went  to  veterans  who  had  already  died.*®  These  overpayments  increase  the 
amount  of  debt  or  accounts  receivable  that  VBA  must  subsequently 
attempt  to  collect.  Full  linkage  to  MVR  could  provide  compensation  and 
pension  personnel  with  notices  of  death  sooner,  and  thereby  help 
minimize  such  overpayments. 


The  second  project  that  we  were  asked  to  address  is  VETSNET.  This 
project  refers  to  a  strategy  VBA  initiated  to  replace  its  existing  old,  high- 
maintenance  payments  systems  with  newer,  lower  maintenance  systems 
that  would  provide  a  rich  data  source  for  answering  questions  about 
veterans’  benefits.*^  VBA  also  expected  VETSNET  to  provide  faster 
processing  of  benefits. 

Two  major  projects  initiated  under  VETSNET  were  compensation  and 
pension  (C&P)  replacement  and  education  redesign.  The  C&P  project  was 
intended  to  replace  VBA’s  existing  legacy  compensation  and  pension 
payment  systems  with  one  new,  state-of-the-art  system.  This  project, 
which  began  in  April  1996,  had  an  estimated  cost  of  $8  million  and  was 
scheduled  for  completion  in  May  1998.  The  education  redesign  project  was 
intended  to  replace  each  of  VBA’s  four  education  payment  systems.*®  This 
project,  which  began  in  Januaiy  1997,  had  an  estimated  cost  of  $9  million 
and  was  scheduled  for  completion  in  December  1998. 


*®The  OIC  sampled  324  overpayments  and  found  that  of  these,  65  overpayments  totaling  $180,261  were 
issued  to  veterans  who  had  already  died. 

*^From  fiscal  year  1986  through  fiscal  year  1995,  VBA  reportedly  spent  at  least  $284  million 
modernizing  its  systems,  including  replacing  its  old  computer  terminals  with  personal  computers  and 
developing  software  applications  to  assist  staff  in  claims  processing. 

*®VBA's  four  education  payment  systems  are  chapter  30.  chapter  32,  chapter  35,  and  chapter  1606. 

Each  of  these  Is  named  for  the  statute  that  provides  the  specific  education  benefit.  For  example, 
chapter  30  provides  benefits  to  active  duty  servicemen,  and  chapter  1606  is  for  reservists. 
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Neither  of  these  two  major  projects  has  yet  been  completed.  The  C&P 
replacement  project  missed  several  key  milestones,  including  its  May  1998 
completion  date  and  a  revised  completion  date  of  December  1998.  VBA 
currently  has  no  expected  completion  date  for  this  project.  The  education 
redesign  project  was  terminated  without  a  product  in  November  1997,  and 
VBA  has  not  established  a  date  for  when  this  project  will  be  restarted.  To 
date,  at  least  $11.5  million  has  reportedly  been  spent  on  the  VETSNET 
C&P  replacement  project  and  about  $3  million  on  the  education  redesign 
project,  with  no  measurable  improvement  in  service  to  veterans.*® 

We  and  others  have  previously  reported  on  problems  that  VBA  has  had  in 
completing  the  VETSNET  C&P  and  education  redesign  projects.^®  One  key 
reason  for  these  problems  is  the  lack  of  an  integrated  architecture  defining 
the  business  processes,  information  flows  and  relationships,  business 
requirements,  and  data  descriptions.  For  example,  the  C&P  project  was 
begun  before  VBA  had  fully  developed  and  validated  its  business 
requirements  on  what  the  new  system  was  supposed  to  do.  Project  delays 
subsequently  resulted  because  of  confusion  over  the  specific  requirements 
to  be  developed.  At  the  same  time,  the  contractor  for  the  education 
redesign  project  cited  problems  with  the  constant  redefining  of  the 
computer  hardware  and  software  to  be  used. 

Another  key  reason  for  its  problems  with  the  VETSNET  projects  is  VBA’s 
immature  software  development  capability.  In  1996  we  reported  and 
testified^*  that  VBA's  software  development  capability  was  ad  hoc  and 
chaotic — the  lowest  level  of  software  development  capability.  More 
specifically,  at  this  level,  VBA  could  not  reliably  develop  and  maintain 
high-quality  software  on  any  major  project  within  cost  and  schedule 
constraints.  Reviews  by  us  and  VA  illustrated  that  these  projects  had 
difficulties  meeting  deadlines  and  that  not  all  critical  systems  development 
areas  were  adequately  addressed.  For  example,  in  our  May  1997  report,  we 


*®Since  1996,  VBA  has  reportedly  spent  at  least  $  100  million  on  VETSNET  and  other  related  projects, 
such  as  the  Loan  Services  and  Claims,  Expended  Lender  Index,  Loan  Processing,  and  the  Automated 
Appraisal  Assignment  (renamed  VA  Assignment  System)  systems. 

Veterans  Benefits  Modernization:  Management  and  Technical  Weaknesses  Must  Be  Overcome  if 
Modernization  Is  to  Succeed  iCfiiO/T-MMD-96-\OX  June  19,  1996),  Veterans  Benefits  Computer 
Systems:  Risks  of  VBA's  Year  2000  Program  (GAO/AIM 0.97.79,  May  30, 1997).and  VETSNET  Quarterly 
Review,  Office  of  Information  Resources  Management,  Department  of  Veterans  Affairs,  March  1998. 

Software  Capability  Evaluation:  VA's  Software  Development  Process  Is  Immature  (GAO/AIMD-96-90, 
June  19, 1996)  andGAO/T-AIMD.96.103,  June  19, 1996. 
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noted  that  both  the  C&P  replacement  and  education  redesign  projects  had 
missed  deadlines  and  had  schedule  delays.22 

VBA  officials  acknowledge  these  problems  and  have  informed  us  that 
efforts  are  underway  to  address  them.  As  we  have  previously 
recommended,  it  is  critical  that  VBA  establish  a  complete,  integrated 
systems  architecture  and  improve  its  software  development  capability  if  it 
is  to  avoid  problems  like  these  in  the  future. 


VHAsDSS  Has  Been 
Implemented,  but  System 
Usage  Varies 


VHA’s  decision  support  system—DSS— is  an  executive  information  system 
that  can  provide  VHA  managers  and  clinicians  with  data  on  patterns  of 
patient  care  and  patient  health  outcomes,  as  well  as  the  capability  to 
analyze  resource  utilization  and  the  cost  of  providing  health  care  services. 
VHA  intends  to  use  DSS  to  (1)  prepare  budgets  for  its  medical  centers, 

(2)  allocate  resources  based  on  performance  and  workload,  (3)  generate 
productivity  analyses  and  patient-specific  costs,  (4)  support  continual 
quality  improvement  initiatives,  (5)  measure  outcomes-based  performance 
and  effectiveness  of  health  care  delivery  processes,  and  (6)  improve 
efficiency  of  care  processes  through  the  use  of  clinical  practice  guidelines. 

VHA  planned  to  implement  DSS  at  all  of  its  medical  centers — currently 
143— from  1994  through  1997  at  an  estimated  cost  of  $132  million. 
Beginning  in  May  1994,  VHA  implemented  DSS  in  its  medical  centers  in  six 
separate  implementation  efforts.  It  had  been  implemented  at  all  VA 
medical  centers  by  the  end  of  October  1998.  The  total  estimated  cost 
through  fiscal  year  1999  to  develop  and  operate  DSS  was  reportedly  at 
least  $213  million.^^  VHA  expects  to  spend  about  $48  million  to  operate 
DSS  this  year. 

Although  VHA  could  not  quantify  the  benefits  derived  from  the  use  of  DSS, 
to  date  at  least  44  VHA  medical  centers  and  selected  Veterans  Integrated 
Service  Networks  (VISN)^^  have  cited  benefits  attributable  to  DSS, 
including  cost  reductions  and  improved  clinical  processes.  For  example, 
VISN  9  determined  that  integrating  services  between  its  Nashville  and 
Murfreesboro  (Tennessee)  medical  centers  could  result  in  projected 


22cAO/AlMD-97-79.May30.  1997. 

^^his  amount  Includes  the  cost  of  studying,  developing,  and  implementing  DSS,  It  covers  the  period 
from  fiscal  years  1992  through  1999. 

^“^VHA  Is  composed  of  22  VISNs,  which  arc  regional  organizations  encompassing  medical  centers, 
nursing  homes,  and  domiciliarics. 
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savings  of  $5.8  million.^s  In  another  example,  the  clinical  practice  of 
routinely  ordering  two  units  of  pre-surgery  autologous^®  blood  for  total 
knee  replacement  was  changed,  at  the  Portland  (Oregon)  VA  medical 
center,  resulting  in  estimated  savings  of  $600-h  per  case. 

However,  none  of  the  medical  centers  and  VISNs  we  contacted  use  DSS 
for  all  of  the  purposes  for  which  VHA  intended.  For  example,  of  the  20 
VISNs  we  contacted — representing  126  medical  centers — only  3  VISNs — 
representing  14  medical  centers — use  DSS  for  budget  formulation  and 
resource  allocation,  according  to  DSS  staff.  Instead,  they  tend  to  use  the 
cost  distribution  report^?  for  budget  formulation  and  the  Veterans 
Equitable  Resource  Allocation  modeF  for  resource  allocation.  Only  one 
VISN  has  begun  to  use  DSS  to  measure  outcomes-based  performance  and 
effectiveness  of  health  care  delivery  processes. 

A  variety  of  reasons  were  given  for  why  more  medical  centers  and  VISNs 
have  not  made  greater  use  of  DSS.  First,  some  medical  centers  have  been 
reluctant  to  use  DSS  because  of  concerns  about  the  accuracy  and 
completeness  of  its  data.  Work  performed  by  us,  VA’s  OIG,  and  the  DSS 
Steering  Committee  has  raised  similar  concerns.^^  Second,  VHA  fiscal 
officials  that  we  intendewed  told  us  that  medical  centers  need  about  2 
years  of  DSS  data  before  the  system  can  be  used  for  budget  formulation 
and  resource  allocation.  It  was  not  until  last  October  that  the  52  medical 
centers  in  the  final  round  of  DSS  implementation  had  accumulated  2  years 
of  data. 


^^VISN  9  has  medical  centers  in  Huntington.  West  Virginia;  Lexington  and  Louisville,  Kentucky:  and 
Memphis,  Mountain  Home,  Murfreesboro,  and  Nashville,  Tennessee. 

2®  Autologous  (a  patient's  own)  blood  is  provided  by  the  patient  in  advance  of  surgery. 

^^The  cost  distribution  report  is  limited  to  information  on  where  the  cost  is  expended;  for  example,  a 
medical  bed  for  an  in-patient  and  a  clinical  stop  grouping  for  an  outpatient.  In  contrast,  DSS  provides 
cost  information  that  shows  where  the  services  were  provided  and  actual  resources  consumed  by 
patient  and  by  care  encounter. 

^®This  model  was  adopted  to  ensure  an  equitable  distribution  of  funds  to  VISNs  rather  than  simply 
being  based  on  historic  funding  patterns.  It  provides  VISNs  with  national  workload  prices  for  three 
types  of  patients.  In  fiscal  year  1999,  VISNs  received  $66  for  a  basic  single  outpatient  visit,  $2,857  for 
basic  vested  care  patients  (those  with  routine  health  care  needs),  and  $36,955  for  complex  care 
patients  (those  with  complex/chronic  health  care  needs). 

VA  Health  Care  Delivery:  Top  Management  Leadership  Critical  to  Success  of  Decision  Support 
System  (CAO/AIMD-95-182.  September  29,  1995),  Audit  of  Veterans  Health  Administration  Decision 
Support  System  Standardization  (Report  No.  9R4-A19  075,  March31,  1999),  DSS  Steering  Committee 
Report.  May  14, 1999. 
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Third,  DSS  usage  may  have  been  hampered  by  insufficient  staff,  staff  with 
inadequate  skills,  and  staff  turnover.  For  example,  according  to  a  post- 
implementation  review  performed  by  VA’s  IRM  Policy  and  Standards 
Service,  over  70  percent  of  the  medical  centers  had  not  followed  staffing 
guidelines  recommended  by  VHA’s  Implementation  and  Training  Service. 
The  review  further  stated  that  in  some  of  these  medical  centers,  the  DSS 
teams  were  understaffed  by  as  much  as  50  percent.  VHA’s  previous  deputy 
director  for  technical  implementation  also  told  us  that  some  medical 
center  directors  assigned  personnel  with  inadequate  skills.  Additionally, 
several  VISN  DSS  coordinators  said  that  they  have  had  difficulty  retaining 
well-trained  DSS  personnel. 

We  have  discussed  these  concerns  with  VHA  officials  and  they  generally 
concur  with  them.  According  to  these  officials,  efforts  are  underway  to 
address  these  problems  and  corrective  actions  are  expected  to  be 
completed  by  2002.  It  is  critical  that  VHA  follow  through  in  addressing 
these  problems  if  it  is  to  achieve  the  benefits  intended  from  the  hundreds 
of  millions  of  dollars  spent  to  date  on  DSS. 


VA  Has  Begun  to 
Address  Computer 
Security  Challenges 


The  last  area  we  were  asked  to  discuss  is  computer  security — critical  to 
VA’s  ability  to  safeguard  its  assets,  maintain  the  confidentiality  of  sensitive 
information,  and  ensure  the  reliability  of  its  financial  data.  If  effective 
computer  security  practices  are  not  in  place,  sensitive  information 
contained  in  VA's  systems  is  at  risk  of  inadvertent  or  deliberate  misuse, 
fraud,  improper  disclosure,  or  destruction — possibly  occurring  without 
detection. 

In  September  1998  we  reported  that  VA’s  lack  of  effective  information 
system  controls  placed  critical  department  operations — such  as  financial 
management,  health  care  delivery,  benefits  payments,  and  other 
operations — at  risk  of  misuse  and  disruption.^®  A  key  reason  for  these 
continuing  information  systems  control  problems  was  that  the  department 
did  not  have  a  comprehensive  computer  security  planning  and 
management  program.  Accordingly,  we  recommended  that  the  Secretary 
develop  and  implement  such  a  departmentwide  program,  and  work  with 
the  VBA  and  VHA  CIOs  and  facility  directors  to  implement  appropriate 
security  measures  and  controls  in  agency  facilities.  VA  recognized  the 
significance  of  these  problems  and  reported  information  systems  security 


^^Inforwatlon  Systems:  VA  Computer  Control  Weaknesses  Increase  Risk  of  Fraud,  Misuse,  and 
Improper  Disclosure  (GAO/AlMD-98-175,  September  23,  1998). 
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as  a  material  weakness  in  its  Federal  Managers’  Financial  Integrity  Act 
reports  for  1998  and  1999. 

To  address  our  recommendation  to  develop  a  comprehensive  computer 
security  planning  and  management  program,  VA  established  a  centrally 
managed  security  group  in  February  1999  and  an  information  security 
working  group  in  March  1999.  Since  then,  VA  has  (1)  developed  a 
departmentwide  plan  to  improve  information  systems  security  throughout 
the  department,  (2)  established  a  departmentwide  computer  security 
planning  and  management  program,  and  (3)  initiated  a  program  to 
increase  computer  security  awareness  across  its  administrations  and 
offices.  VA  is  now  developing  a  risk-based  framework  for  addressing 
information  security  issues. 

In  addition,  VA  organizations  have  independently  initiated  actions  to 
improve  certain  aspects  of  their  computer  security  programs.  For 
example,  as  we  reported  in  October  1999,^*  the  Austin  Automation  Center 
corrected  most  of  the  computer  security  issues  we  identified  in  1998. 
Specifically,  the  center  reduced  the  number  of  users  with  access  to  the 
computer  room;  restricted  access  to  certain  sensitive  libraries,  audit 
information,  and  utilities:  improved  identification  and  password 
management  controls:  developed  a  formal  software  change  control 
process:  and  expanded  tests  of  its  disaster  recovery  plan. 

In  contrast,  the  VBA  benefits  delivery  centers  are  still  in  the  process  of 
correcting  most  of  the  weaknesses  we  reported  in  1998.  For  example, 
information  security  reviews  performed  by  VA’s  OIG  in  1999  found  that 
only  one  of  seven  weaknesses  we  found  had  been  corrected  at  the 
Philadelphia  benefits  delivery  center  and  that  five  of  seven  weaknesses 
had  not  been  fully  addressed  by  the  Hines.  Illinois,  benefits  delivery 
center. 

In  addition,  audits  by  us  as  well  as  by  VA’s  OIG  continue  to  find  serious 
problems  related  to  the  department’s  control  and  oversight  of  access  to  its 
computer  systems  at  VA  facilities  such  as  the  Philadelphia  Insurance 
Center,  and  the  Hines  (Illinois)  and  Philadelphia  benefits  delivery 
centers.32  For  example,  VA  still  has  not  adequately  limited  the  access 
granted  to  authorized  users,  appropriately  segregated  incompatible  duties 
among  computer  personnel,  adequately  managed  user  identifications  and 


^  *  Information  Systems:  The  Sta  tus  of  Computer  Security  at  the  Department  of  Veterans  Affairs 
(GAO/AlMD-00-5,  October  4,  1999). 

32CAO/AIMD-00-5,  October  4.  1999. 
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passwords,  or  routinely  monitored  access  activity.  We  made  several 
recommendations  to  address  these  problems. 


In  summary,  VA  has  improved  its  process  for  selecting,  controlling,  and 
evaluating  IT  investments  for  CIB-level  projects  since  1998.  However,  VA 
has  yet  to  fill  its  full-time  department  CIO  vacancy  since  its  creation 
almost  2  years  ago.  Further,  VA  may  encounter  serious  problems  achieving 
its  “One  VA”  vision  until  it  develops  an  overall  business  process 
improvement  strategy  and  a  departmentwide,  integrated  IT  architecture. 
Full  implementation  of  our  recommendations  in  these  areas  is  essential  to 
VA’s  achieving  its  “One  VA”  vision.  In  addition,  top  management  support 
and  commitment  are  essential  to  addressing  the  challenges  VA  faces  in  (1) 
completing  implementation  of  MVR.  (2)  addressing  technical  problems  in 
developing  VETSNET,  and  (3)  making  greater  use  of  DSS.  Improving  VA’s 
computer  security  will  also  take  sustained  leadership  and  commitment  to 
develop  and  implement  a  comprehensive  security  planning  and 
management  program  over  the  next  few  years. 

We  performed  this  assignment  in  accordance  with  generally  accepted 
government  auditing  standards,  from  July  1999  through  April  2000.  In 
carrying  out  this  assignment,  we  reviewed  and  analyzed  VA’s  IT 
investment  process  policies  and  compared  these  with  applicable  guidance 
in  this  area.  We  also  analyzed  the  results  of  IT  investments  conducted  by 
the  CIB,  VA  OI&T,  and  VA  components/offices.  In  particular,  we  reviewed 
17  IT  proposals  submitted  as  part  of  the  department’s  fiscal  year  2000 
investment  planning  process  and  12  IT  proposals  submitted  as  part  of  the 
fiscal  year  2001  process.  We  reviewed  VA’s  directives  regarding  the 
responsibilities  of  the  CIO  and  reviewed  and  analyzed  VA.  VBA,  and  VHA 
IT  architecture  documents,  comparing  these  to  NIST’s  five-layer  standard, 
the  guidance  used  by  VA.  For  the  MVR.  VETSNET,  and  DSS  projects,  we 
reviewed  and  analyzed  costs,  schedules,  and  status  updates.  In  the  area  of 
computer  security,  we  reviewed  our  recent  reports  and  VA  updates  on 
actions  taken  to  address  our  recommendations. 

Mr.  Chairman,  this  concludes  my  statement.  I  would  be  pleased  to  respond 
to  any  questions  that  you  or  other  members  of  the  Subcommittee  may 
have  at  this  time. 


Contact  and  information  about  this  testimony,  please  contact  Joel  C.  Willemssen  at 

A rV nn\A7l pH om pn tc  2-6253  or  by  e-mail  at  wiIlemssenJ.aimd@gao.gov.  Individuals 

witru^iiiCllLb  making  key  contributions  to  this  testimony  included  Nabajyoti  Barkakati, 
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Amanda  Gill,  Tonia  Johnson.  Robert  Kershaw,  Helen  Lew,  Barbara  Oliver, 
J.  Michael  Resser,  John  Riley,  and  Henry  Sutanto. 
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Note;  GAO  comment 
supplementing  those  in  the 
report  text  appears  at  the 
end  of  this  appendix 


Department  of  Veterans  Affairs 
Washington  DC  20420 


JUL  !  0  2000 


Mr.  Jeffrey  C.  Steinhoff 

Assistant  Comptroller  General 

Accounting  and  Information  Management  Division 

U.  S.  General  Accounting  Office 

441  G  Street,  NW 

Washington,  DC  20548 

Dear  Mr.  Steinhoff: 

We  have  reviewed  your  draft  report,  INFORMATION  TECHNOLOGY:  VA 
Actions  Needed  to  Implement  Critical  Reforms  (GAO/AIMD-00-226).  As  GAO 
reports,  we  have  achieved  much  progress  in  addressing  its  earlier 
recommendations  particularly  In  our  information  technology  (IT)  review  process. 

The  Department  will  continue  strengthening  Its  capital  investment  planning, 
making  improvements  to  streamline  the  process  while  continuing  to  capture 
information  needed  to  make  informed  investment  decisions.  Nevertheless,  we 
recognize  VA  still  faces  real  challenges  including  those  GAO  has  identified. 

When  the  Secretary  decided  in  1998  to  establish  an  independent  Chief 
Information  Officer  (CIO)  function,  the  Department  moved  swiftly  to  realign  its 
resources  to  support  that  decision.  Since  then,  the  Principal  Deputy  Assistant 
Secretary  for  Information  and  Technology  has  served  in  the  CIO  capacity, 
spearheading  the  Department's  efforts  to  streamline  and  integrate  itself  to  a  One- 
VA  posture  that  provides  seamless  service  to  our  nation's  veterans.  While  we 
have  yet  to  achieve  that  vision,  we  continue  to  make  strides  towards  this  end. 

The  Department  concurs  in  GAO's  recommendations  with  one  Important 
exception:  business  process  reengineering  remains  delegated  to  the  business 
administrations.  Those  organizations  best  understand  the  desired  outcomes  of  their 
missions  and  the  most  effective  and  efficient  means  to  achieve  them.  The  enclosure 
details  actions  taken  and  planned  to  implement  GAO's  recommendations. 

Thank  you  for  the  opportunity  to  comment  on  your  draft  report. 


Dennis  Dvrpf^ 
Assistam  Spwetary  for 
Planning^nd  Analysis 

Enclosure 
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Enclosure 

DEPARTMENT  OF  VETERANS  AFFAIRS 
COMMENTS  TO  GAO  DRAFT  REPORT, 

INFORMA  TION  TECHNOLOGY:  VA  Actions  Needed  to 
Implement  Critical  Reforms 
(GAO/AIMD-00-226) 


GAO  recommends: 

As  noted  in  our  testimony,  timely  in-process  reviews  are  a  key 
component  of  the  IT  decisionmaking  process,  and  assist  VA  in 
controlling  approved  projects.  We  therefore  recommend  that  you 
take  action  to  improve  VA's  IT  investment  decision  making  process 
by 

•  Establishing  and  monitoring  deadlines  for  completing  formal  in- 
process  reviews  at  key  milestones  in  a  project's  life  cycle; 

Concur  -  VA's  Chief  information  Officer  (CIO)  Council  conducts  quarterly  reviews 
to  monitor  the  progress  of  IT  projects  by  tracking  costs,  schedule,  and 
performance.  During  these  reviews,  projects  that  have  deficiencies  or  problems 
are  identified.  At  this  time,  the  CIO  Council  may  request  an  in-process  review 
(I PR),  or  a  formal  briefing  from  the  project/program  office  to  obtain  additional 
information.  If,  during  this  briefing,  the  CIO  Council  believes  more  information  is 
needed,  the  CIO  Council  may  also  request  an  IPR.  VA's  IPRs  are  not  routine 
scheduled  assessments  but  reviews  conducted  on  an  exception  basis.  In 
addition  to  the  CIO  Council  requesting  an  IPR,  other  key  VA  officials  can  request 
such  reviews  for  an  independent  evaluation.  These  requests  may  not  coincide 
with  a  key  milestone  in  the  project’s  life  cycle.  Once  an  IPR  is  requested,  a 
review  team  is  established.  The  team  is  responsible  for  developing  a  review  plan 
that  outlines  the  complete  review  process  that  includes  a  planned  completion 
date  for  issuing  a  formal  IPR  report. 


•  Providing  decisionmakers,  such  as  investment  panel  members, 
with  Information  on  lessons  learned  from  post-implementation 
reviews  of  IT  projects  so  that  they  can  use  such  data  In  making 
better  informed  Judgments  about  projects;  and 

Concur  -  Post-implementation  review  findings  will  be  provided  to  investment 
panel  members. 
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(Continued) 


•  Developing  and  implementing  guidance  to  better  manage  IT 
projects  below  the  Capital  Investment  Board  threshold. 

Concur  -  In  May  2000,  VA's  Office  of  Information  and  Technology  completed  an 
Information  Technology  Investment  Guide  and  conducted  a  training  workshop  on 
May  31,  2000.  The  guide  is  available  on  VA's  intranet  at 

httD://vaww.va.Qov/oirm/ltDlannina/IT  Capital  Investment  Guide.htm.  The  guide 
is  scheduled  for  printing  and  distribution  this  month. 


GAO  also  recommends: 

Full  Implementation  of  key  provisions  of  the  Clinger-Cohen  Act 
provides  a  foundation  for  an  agency's  effective  use  of  IT,  as  well  as  being 
required  by  law.  We  therefore  recommend  that  you  take  action  to  ensure 
that  VA  fully  addresses  these  key  provisions  by 

•  Filling  the  position  of  assistant  secretary  for  information  and 
technology  as  quickly  as  possible  to  provide  the  needed 
leadership  to  achieve  the  "One  VA"  vision; 

Concur  -  On  June  25,  1998,  the  then  Secretary  of  Veterans  Affairs  decided  to 
separate  the  CIO  function  from  the  Chief  Financial  Officer  and  create  a  new 
Assistant  Secretary  position  to  assume  the  duties  of  the  CIO.  The  entire 
organization  of  the  Deputy  Assistant  Secretary  for  Information  Resources 
Management  was  realigned  under  the  new  Assistant  Secretary,  The  new  office 
was  activated  on  July  1,  1998,  with  the  assignment  of  a  Principal  Deputy 
Assistant  Secretary  (PDAS).  On  June  1,  2000,  the  PDAS  retired,  and  the 
Secretary  designated  an  Acting  PDAS,  Untii  the  appointment  process  for  a  new 
Assistant  Secretary  Is  completed,  the  PDAS  will  be  the  Acting  CIO.  This  change 
permits  the  appropriate  emphasis  on  the  Department's  information  and 
technology  issues,  which  are  keys  to  improving  service  to  veterans. 
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•  Reassessing  VA's  decision  to  delegate  business  process 
reengineering  to  the  individual  administrations;  and 

Non-Concur  -  The  Department's  business  process  reengineering  (BPR)  is  a 
constantly  evolving  function  that  is  not  conducted  in  a  vacuum.  Whiie  primariiy 
the  responsibility  of  the  business  administrations,  reengineering  is  combined  with 
a  VA  enterprise  IT  architecture  (see  recommendation  6)  and  IT  capital 
investment  process.  This  combination  will  provide  the  Department  with  the 
processes  and  strategies  necessary  to  ensure  BPR,  as  necessary,  is 
accomplished. 


•  Directing  the  Department's  CIO  or  designee  to  lead  the  effort  and 
work  with  VA  business  owners  to  develop  a  logical  architecture 
as  a  step  toward  an  Integrated  IT  architecture. 

Concur  -  At  the  May  11,  2000,  House  Committee  on  Veterans  Affairs 
Subcommittee  on  Oversight  and  Investigations  hearing  on  iT,  VA's  Acting  CIO 
agreed  to  provide  the  Committee  with  a  plan  for  developing  an  enterprise  IT 
architecture  that  follows  the  NIST  five-year  model.  We  are  preparing  the  plan 
and  a  statement  of  work  for  contractor  support  to  assist  the  development  of  the 
architecture  and  will  send  it  to  the  Committee  shortly. 


Additional  Comments: 

Regarding  the  Master  Veteran  Record  (MVR)  initiative,  the  Acting  CIO  stated  in  a 
July  1999  memorandum  to  VA's  Under  Secretary  for  Benefits  that  MVR  was  a 
completed  initiative.  This  determination  was  based  upon  the  assessment  that 
the  maximum  practical  application  of  background  message  exchange  technology 
had  been  achieved  for  cross-Administration  data  sharing,  i.e.  limited  to  change  of 
address,  change  of  percent  of  disability,  and  death  notices.  MVR  was  never 
scoped  to  be  a  grand  design  or  business-reengineering  project  nor  was  It 
budgeted  as  such. 


3 


Page  32 


GAO/AIMD-00-226  VA  Actions  Needed  to  Implement  Critical  Reforms 


Appendix  II 

Comments  From  the  Department  of  Veterans 
Affairs 


The  following  is  GAO's  comment  on  the  Department  of  Veterans  Affairs' 
letter  dated  July  10,  2000. 


GAO  Comment 


Discussed  in  “Agency  Comments  and  Our  Evaluation”  section  of  the 
report. 


(511852) 
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